Timing index anomaly detection method, device and apparatus

Abstract

The present disclosure discloses a timing index anomaly detection method, device and apparatus. The method includes the following operations. A plurality of pieces of timing index information about a service to be detected is acquired. The plurality of pieces of timing index information is filtered according to a filtering condition, and timing index information satisfying a preset filtering condition is retained. The filtering condition corresponds to an anomaly detection condition. A tag is added to the timing index information satisfying the preset filtering condition to form first timing index information. The tag is used for identifying the anomaly detection condition. The first timing index information is forwarded to a preset working node corresponding to the tag. anomaly detection is performed on the first timing index information on the same preset working node. It is determined whether an anomaly prompt is output.

What is claimed is: 
     
       1. A timing index anomaly detection method, comprising:
 acquiring a plurality of pieces of timing index information about a service to be detected; 
 filtering, by a filtering layer, the plurality of pieces of timing index information according to a preset filtering condition, and retaining timing index information satisfying the preset filtering condition, the preset filtering condition corresponding to an anomaly detection condition, wherein the filtering layer is stateless and is able to be expanded horizontally according to an amount of data of the service to be detected; 
 adding a tag to the timing index information satisfying the preset filtering condition to form first timing index information, the tag being used for identifying the anomaly detection condition; 
 forwarding the first timing index information to a preset working node corresponding to the tag; 
 performing, by a working layer, anomaly detection on the first timing index information on the preset working node, wherein the working layer is able to be expanded horizontally; and 
 determining whether an anomaly prompt is output. 
 
     
     
       2. The timing index anomaly detection method according to  claim 1 , wherein performing, by a working layer, anomaly detection on the first timing index information on the preset working node comprises:
 aggregating, according to a preset aggregating condition within a preset period, the first timing index information on the preset working node to form second timing index information; and 
 performing anomaly detection on the second timing index information. 
 
     
     
       3. The timing index anomaly detection method according to  claim 2 , wherein performing anomaly detection on the second timing index information to determine whether the anomaly prompt is output comprises:
 performing anomaly detection on the second timing index information; 
 adding a detection result to the second timing index information to form third timing index information and storing the third timing index information; 
 judging whether the third timing index information complies with an anomaly condition; and 
 when a judging result is that the third timing index information complies with the anomaly condition, outputting an anomaly prompt. 
 
     
     
       4. The timing index anomaly detection method according to  claim 3 , wherein outputting the anomaly detection prompt comprises:
 outputting the anomaly prompt and anomaly result information. 
 
     
     
       5. The timing index anomaly detection method according to  claim 1 , wherein there are at least two anomaly detection conditions, and forwarding the first timing index information to the preset working node corresponding to the tag, performing anomaly detection on the first timing index information on the preset working node and determining whether the anomaly prompt is output comprises:
 forwarding the first timing index information to at least two preset working nodes corresponding to tags one by one; 
 aggregating, according to a preset aggregating condition within a preset period, the first timing index information on the preset working node to form second timing index information; 
 performing anomaly detection on the second timing index information on each of the preset working nodes; and 
 determining whether each working node outputs an anomaly prompt. 
 
     
     
       6. The timing index anomaly detection method according to  claim 1 , wherein
 there are at least two anomaly detection conditions; and 
 forwarding the first timing index information to the preset working node corresponding to the tag and performing anomaly detection on the first timing index information on the preset working node comprises: 
 forwarding the first timing index information containing different tags to the preset working node; 
 filtering the first timing index information on the preset working node according to the tags; and 
 performing anomaly detection on the filtered first timing index information on the preset working node. 
 
     
     
       7. The timing index anomaly detection method according to  claim 1 , wherein
 performing anomaly detection on the first timing index information on the preset working node comprises: 
 performing anomaly detection on the first timing index information on the preset working node according to a preset strategy that is selected according to the anomaly detection condition. 
 
     
     
       8. The timing index anomaly detection method according to  claim 7 , wherein the preset strategy comprises any one or a combination of a threshold trigger strategy, a jitter trigger strategy, a year-on-year trigger strategy, or a month-on-month trigger strategy. 
     
     
       9. A computer device, comprising:
 a memory, configured to store a computer program; and 
 a processor, configured to implement, when executing the computer program, the following actions: 
 acquiring a plurality of pieces of timing index information about a service to be detected; 
 filtering, by a filtering layer, the plurality of pieces of timing index information according to a preset filtering condition, and retaining timing index information satisfying the preset filtering condition, the preset filtering condition corresponding to an anomaly detection condition, wherein the filtering layer is stateless and is able to be expanded horizontally according to an amount of data of the service to be detected; 
 adding a tag to the timing index information satisfying the preset filtering condition to form first timing index information, the tag being used for identifying the anomaly detection condition; 
 forwarding the first timing index information to a preset working node corresponding to the tag; 
 performing, by a working layer, anomaly detection on the first timing index information on the preset working node, wherein the working layer is able to be expanded horizontally; and 
 determining whether an anomaly prompt is output. 
 
     
     
       10. The computer device according to  claim 9 , wherein performing, by a working layer, anomaly detection on the first timing index information on the preset working node comprises:
 aggregating, according to a preset aggregating condition within a preset period, the first timing index information on the preset working node to form second timing index information; and 
 performing anomaly detection on the second timing index information. 
 
     
     
       11. The computer device according to  claim 10 , wherein performing anomaly detection on the second timing index information to determine whether the anomaly prompt is output comprises:
 performing anomaly detection on the second timing index information; 
 adding a detection result to the second timing index information to form third timing index information and storing the third timing index information; 
 judging whether the third timing index information complies with an anomaly condition; and 
 when a judging result is that the third timing index information complies with the anomaly condition, outputting an anomaly prompt. 
 
     
     
       12. The computer device according to  claim 9 , wherein there are at least two anomaly detection conditions, and forwarding the first timing index information to the preset working node corresponding to the tag, performing anomaly detection on the first timing index information on the preset working node and determining whether the anomaly prompt is output comprises:
 forwarding the first timing index information to at least two preset working nodes corresponding to tags one by one; 
 aggregating, according to a preset aggregating condition within a preset period, the first timing index information on the preset working node to form second timing index information; 
 performing anomaly detection on the second timing index information on each of the preset working nodes; and 
 determining whether each working node outputs an anomaly prompt. 
 
     
     
       13. The computer device according to  claim 9 , wherein
 there are at least two anomaly detection conditions; and 
 forwarding the first timing index information to the preset working node corresponding to the tag and performing anomaly detection on the first timing index information on the preset working node comprises: 
 forwarding the first timing index information containing different tags to the preset working node; 
 filtering the first timing index information on the preset working node according to the tags; and 
 performing anomaly detection on the filtered first timing index information on the preset working node. 
 
     
     
       14. The computer device according to  claim 9 , wherein
 performing anomaly detection on the first timing index information on the preset working node comprises: 
 performing anomaly detection on the first timing index information on the preset working node according to a preset strategy that is selected according to the anomaly detection condition. 
 
     
     
       15. A non-transitory media, the non-transitory media storing a program which, when executed, is capable of implementing the following actions:
 acquiring a plurality of pieces of timing index information about a service to be detected; 
 filtering, by a filtering layer, the plurality of pieces of timing index information according to a preset filtering condition, and retaining timing index information satisfying the preset filtering condition, the preset filtering condition corresponding to an anomaly detection condition, wherein the filtering layer is stateless and is able to be expanded horizontally according to an amount of data of the service to be detected; 
 adding a tag to the timing index information satisfying the preset filtering condition to form first timing index information, the tag being used for identifying the anomaly detection condition; 
 forwarding the first timing index information to a preset working node corresponding to the tag; 
 performing, by a working layer, anomaly detection on the first timing index information on the preset working node, wherein the working layer is able to be expanded horizontally, and the filtering layer and the working layer are stripped; and 
 determining whether an anomaly prompt is output. 
 
     
     
       16. The non-transitory media according to  claim 15 , wherein performing anomaly detection on the first timing index information on the preset working node comprises:
 aggregating, according to a preset aggregating condition within a preset period, the first timing index information on the preset working node to form second timing index information; and 
 performing anomaly detection on the second timing index information. 
 
     
     
       17. The non-transitory media according to  claim 16 , wherein performing anomaly detection on the second timing index information to determine whether the anomaly prompt is output comprises:
 performing anomaly detection on the second timing index information; 
 adding a detection result to the second timing index information to form third timing index information and storing the third timing index information; 
 judging whether the third timing index information complies with an anomaly condition; and 
 when a judging result is that the third timing index information complies with the anomaly condition, outputting an anomaly prompt. 
 
     
     
       18. The non-transitory media according to  claim 15 , wherein there are at least two anomaly detection conditions, and forwarding the first timing index information to the preset working node corresponding to the tag, performing anomaly detection on the first timing index information on the preset working node and determining whether the anomaly prompt is output comprises:
 forwarding the first timing index information to at least two preset working nodes corresponding to tags one by one; 
 aggregating, according to a preset aggregating condition within a preset period, the first timing index information on the preset working node to form second timing index information; 
 performing anomaly detection on the second timing index information on each of the preset working nodes; and 
 determining whether each working node outputs an anomaly prompt. 
 
     
     
       19. The non-transitory media according to  claim 15 , wherein
 there are at least two anomaly detection conditions; and 
 forwarding the first timing index information to the preset working node corresponding to the tag and performing anomaly detection on the first timing index information on the preset working node comprises: 
 forwarding the first timing index information containing different tags to the preset working node; 
 filtering the first timing index information on the preset working node according to the tags; and 
 performing anomaly detection on the filtered first timing index information on the preset working node. 
 
     
     
       20. The non-transitory media according to  claim 15 , wherein
 performing anomaly detection on the first timing index information on the preset working node comprises: 
 performing anomaly detection on the first timing index information on the preset working node according to a preset strategy that is selected according to the anomaly detection condition.